primcli 3.0.0-preview.10 → 3.0.0-preview.11

package/dist/{api-command-D0KHkqhA.js → api-command-CkMEFiBL.js}

@@ -1,4 +1,4 @@
-import { B as ensureSearchReportsReplyState, Ht as getEmail, J as SENT_EMAIL_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, R as assertAwaitingFilterRows, W as isAwaitingRejectedError, Wn as sdk_gen_exports, Y as WEBHOOK_EVENT_TYPES, Zt as getOwnGrant, at as automatedRejectedError, ct as expectedAutomatedVerdicts, gn as listEndpoints, it as assertAutomatedVerdict, ot as automatedSurfaceForOperation, q as EMAIL_RULE_REQUEST_EVENT_TYPES, rt as AutomatedFilterUnsupportedError, st as ensureSearchReportsAutomated, tn as getThread, ut as isAutomatedRejectedError, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-CDaE-kdZ.js";
+import { B as ensureSearchReportsReplyState, Gn as sdk_gen_exports, J as EMAIL_RULE_REQUEST_EVENT_TYPES, K as replyStateSurfaceForOperation, L as ReplyStateUnsupportedError, Qt as getOwnGrant, R as assertAwaitingFilterRows, Ut as getEmail, W as isAwaitingRejectedError, X as WEBHOOK_EVENT_TYPES, Y as SENT_EMAIL_EVENT_TYPES, _n as listEndpoints, at as assertAutomatedVerdict, ct as ensureSearchReportsAutomated, dt as isAutomatedRejectedError, it as AutomatedFilterUnsupportedError, lt as expectedAutomatedVerdicts, nn as getThread, ot as automatedRejectedError, q as EMAIL_RULE_OBJECTION_EVENT_TYPES, st as automatedSurfaceForOperation, v as parseRetryAfter, z as awaitingRejectedError } from "./repeats-Dj_o6c-X-ChTwFlyB.js";
 import { C as saveCliCredentials, F as agentProfilesDirectory, H as requireDefaultLoginProfile, N as agentProfileDirectory, R as loadConnectedAgentProfile, S as resolveCliAuth, W as PrimitiveApiClient, _ as deleteCliCredentials, b as loadCliCredentials, c as resolveConfigEnvironment, d as validateCliHeaderName, f as validateCliHeaderValue, i as loadCliConfig, j as AGENT_PROFILE_ENV, m as cliAccessTokenExpiresAt, p as acquireCliCredentialsLock, w as saveSignupCredentials, x as normalizeApiBaseUrl, y as detectPrimitiveKeyEnvMisname } from "./cli-config-Ms_0vNjq.js";
 import "./oclif/global-org-flag.js";
 import { a as thrownErrorBody } from "./json-output-ch756TXV.js";
@@ -780,7 +780,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-activity-objects",
-		"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld.",
+		"description": "The objects the caller created, newest first, each with where it stands now, including ones since disabled, deleted or revoked where the object keeps a row: Functions, endpoints, Function triggers, pull subscriptions, recipient routes, filters, wake schedules, repeating sends and scheduled sends. An API key, an app or an agent sees what it created itself; a webhook given to an API key lists under that key. A person (a dashboard session, or their own Primitive CLI or app login) sees what they created through any credential of theirs, each item naming it, and also their API keys, personal agents, email rules, rule requests and objections to rules over their mail (objections only on the dashboard or the Primitive CLI). Each kind is listed only if the caller could list it through that kind's own route; a kind it could not is named in withheld, with no count. Ids, names and states only: never a webhook URL or mail content. Needs activity:read_self. With relation=asked it lists instead what other members asked of the person, open or answered: the rule requests made to them, and the objections to rules they wrote, under their current membership, each naming the member who asked or objected in created_through. A key, an app or an agent has none, and gets both kinds in withheld. With relation=concerning it lists instead what other members did that concerns the person's own mail: each time a rule started covering one of their mailboxes or saved a new version while covering it, named as the rule was then, naming its author in created_through, under their current membership; only on the dashboard or the Primitive CLI. A key, an app or an agent has none, and gets email_rule_coverage in withheld. A notice never reads as ended.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listActivityObjects",
@@ -789,14 +789,18 @@ const operationManifest = [
 		"queryParams": [
 			{
 				"default": "created",
-				"description": "created (the default) or asked.",
-				"enum": ["created", "asked"],
+				"description": "created (the default), asked or concerning.",
+				"enum": [
+					"created",
+					"asked",
+					"concerning"
+				],
 				"name": "relation",
 				"required": false,
 				"type": "string"
 			},
 			{
-				"description": "Only these kinds, comma-separated: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection. Defaults to every kind the caller can have created (a person's own kinds only for a person). With relation=asked, only email_rule_request and email_rule_objection, which are also the default.",
+				"description": "Only these kinds, comma-separated: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection, email_rule_coverage. Defaults to every kind the caller can have created (a person's own kinds only for a person). With relation=asked, only email_rule_request and email_rule_objection, which are also the default; with relation=concerning, only email_rule_coverage, the default. email_rule_coverage is listed only with relation=concerning.",
 				"enum": null,
 				"name": "kind",
 				"required": false,
@@ -850,16 +854,16 @@ const operationManifest = [
 						"properties": {
 							"kind": {
 								"type": "string",
-								"description": "One of: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection."
+								"description": "One of: function, endpoint, function_trigger, pull_subscription, recipient_route, filter_rule, wake_schedule, repeating_send, scheduled_send, api_key, agent_connection, email_rule, email_rule_request, email_rule_objection, email_rule_coverage."
 							},
 							"id": { "type": "string" },
 							"name": {
-								"description": "The name the object is known by: an endpoint's display name, a route's or filter's pattern, a Function's name, a send's From address, a wake schedule's command and the address it wakes, an API key's name, an agent's address, a rule's or rule request's name, and for an objection the name its rule had when the objection was made. Never a webhook URL and never mail content.",
+								"description": "The name the object is known by: an endpoint's display name, a route's or filter's pattern, a Function's name, a send's From address, a wake schedule's command and the address it wakes, an API key's name, an agent's address, a rule's or rule request's name, and for an objection or a coverage notice the name its rule had then. Never a webhook URL and never mail content.",
 								"type": ["string", "null"]
 							},
 							"state": {
 								"type": "string",
-								"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections)."
+								"description": "Where it stands now: enabled, disabled, deleted or replaced (endpoints and routes), enabled or disabled (filters, wake schedules), live, suspended or deleted (Functions), active, paused or ended (repeating sends), scheduled (scheduled sends), active, suspended, expired or revoked (API keys), pending, claimed, connected or revoked (agents), draft, observe or active (email rules), pending, accepted, declined or withdrawn (rule requests and objections), and for a coverage notice what it told: started (a rule began covering your mailbox), new_version, or baseline (it already covered you when notices began)."
 							},
 							"created_at": {
 								"type": "string",
@@ -873,21 +877,21 @@ const operationManifest = [
 							"owned_now": {
 								"type": "string",
 								"enum": ["you", "someone_else"],
-								"description": "you: it is still yours: never transferred, or transferred back to you. someone_else: it was transferred and another person holds it now, or, with relation=asked, another member made it."
+								"description": "you: it is still yours: never transferred, or transferred back to you. someone_else: it was transferred and another person holds it now, or, with relation=asked or concerning, another member made it."
 							},
 							"created_through": {
 								"type": "object",
 								"properties": {
 									"kind": {
 										"type": "string",
-										"description": "The kind of credential it was created through: org_key, function_key, connected_key, oauth, agent_delegate or member (the person themselves). With relation=asked, member: the member who asked or objected."
+										"description": "The kind of credential it was created through: org_key, function_key, connected_key, oauth, agent_delegate or member (the person themselves). With relation=asked, member: the member who asked or objected; with relation=concerning, member: the rule's author."
 									},
 									"id": {
-										"description": "In a person's view, the person's own user id for member, and an API key's id where they may read their keys (for a person limited to their own keys, only a key they still hold). Null otherwise, and always null in one credential's view, where it is the calling credential itself. With relation=asked, the user id of the member who asked or objected.",
+										"description": "In a person's view, the person's own user id for member, and an API key's id where they may read their keys (for a person limited to their own keys, only a key they still hold). Null otherwise, and always null in one credential's view, where it is the calling credential itself. With relation=asked, the user id of the member who asked or objected; with relation=concerning, of the rule's author.",
 										"type": ["string", "null"]
 									},
 									"name": {
-										"description": "In a person's view, what that credential of theirs is called: an app login by its app, an API key by its name, an agent's key by its address. Null otherwise, and for the person themselves. With relation=asked, the name of the member who asked or objected.",
+										"description": "In a person's view, what that credential of theirs is called: an app login by its app, an API key by its name, an agent's key by its address. Null otherwise, and for the person themselves. With relation=asked, the name of the member who asked or objected; with relation=concerning, of the rule's author.",
 										"type": ["string", "null"]
 									}
 								},
@@ -13382,7 +13386,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "get-email-rule-covering-me",
-		"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"description": "One rule that covers one of your own mailboxes, read-only, with its current version; or one that no longer does but decided on mail at your own mailbox (covers_now false), shown as the version that last decided on your mail, without its current name. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, and the member each belongs to, or the organization. You do not see which keys, webhooks or shares they are (no ids, names, prefixes or URLs), the other inboxes and domains its scope names, or its saved expectations. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "getEmailRuleCoveringMe",
@@ -13478,6 +13482,147 @@ const operationManifest = [
 					"exclusiveMinimum": 0,
 					"description": "Null when covers_now is false."
 				},
+				"receivers": {
+					"description": "Null when covers_now is false (who receives it now is not about your mail), or when it could not be read in time.",
+					"anyOf": [{
+						"type": "object",
+						"properties": {
+							"keys": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"owner": { "anyOf": [{
+											"type": "object",
+											"properties": {
+												"kind": {
+													"type": "string",
+													"const": "member"
+												},
+												"user_id": {
+													"type": "string",
+													"description": "The member's user id.",
+													"format": "uuid"
+												},
+												"name": {
+													"description": "Their name; null when they have none set.",
+													"type": ["string", "null"]
+												}
+											},
+											"required": [
+												"kind",
+												"user_id",
+												"name"
+											]
+										}, {
+											"type": "object",
+											"properties": { "kind": {
+												"type": "string",
+												"const": "organization",
+												"description": "Held by no member: an organization key, or one whose holder has left."
+											} },
+											"required": ["kind"]
+										}] },
+										"count": {
+											"type": "integer",
+											"exclusiveMinimum": 0
+										}
+									},
+									"required": ["owner", "count"]
+								},
+								"description": "API keys that work now (not revoked, expired or suspended) whose access lists the rule, or its live share: they read what it matches. Owner: the member who holds each, or the organization."
+							},
+							"webhooks": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"owner": { "anyOf": [{
+											"type": "object",
+											"properties": {
+												"kind": {
+													"type": "string",
+													"const": "member"
+												},
+												"user_id": {
+													"type": "string",
+													"description": "The member's user id.",
+													"format": "uuid"
+												},
+												"name": {
+													"description": "Their name; null when they have none set.",
+													"type": ["string", "null"]
+												}
+											},
+											"required": [
+												"kind",
+												"user_id",
+												"name"
+											]
+										}, {
+											"type": "object",
+											"properties": { "kind": {
+												"type": "string",
+												"const": "organization",
+												"description": "Held by no member: an organization key, or one whose holder has left."
+											} },
+											"required": ["kind"]
+										}] },
+										"count": {
+											"type": "integer",
+											"exclusiveMinimum": 0
+										}
+									},
+									"required": ["owner", "count"]
+								},
+								"description": "Webhooks that are sent what it matches: those whose key, as delivery acts as it, lists the rule or its live share (owner: the member who holds that key, or the organization), and the webhooks of the member the rule is shared with (owner: that member)."
+							},
+							"shares": {
+								"type": "array",
+								"items": {
+									"type": "object",
+									"properties": {
+										"beneficiary": {
+											"type": "object",
+											"properties": {
+												"kind": {
+													"type": "string",
+													"const": "member"
+												},
+												"user_id": {
+													"type": "string",
+													"description": "The member's user id.",
+													"format": "uuid"
+												},
+												"name": {
+													"description": "Their name; null when they have none set.",
+													"type": ["string", "null"]
+												}
+											},
+											"required": [
+												"kind",
+												"user_id",
+												"name"
+											]
+										},
+										"count": {
+											"type": "integer",
+											"exclusiveMinimum": 0
+										}
+									},
+									"required": ["beneficiary", "count"]
+								},
+								"description": "The rule's live share, if it has one (a rule is shared at most once): the member it gives what it matches to."
+							}
+						},
+						"required": [
+							"keys",
+							"webhooks",
+							"shares"
+						],
+						"description": "Who receives what the rule shares now, by person and count; empty unless it is an active grant rule."
+					}, { "type": "null" }]
+				},
 				"created_at": {
 					"type": "string",
 					"format": "date-time"
@@ -13570,6 +13715,7 @@ const operationManifest = [
 				"is_author",
 				"covers",
 				"current_version",
+				"receivers",
 				"created_at",
 				"covers_now",
 				"current"
@@ -14008,7 +14154,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rules-covering-me",
-		"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). You do not see the other inboxes and domains its scope names, its saved expectations, or the keys, shares and webhooks that use it. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
+		"description": "Every email rule that covers one of your own mailboxes now, yours included, newest first, in any state. A rule covers you when the scope it runs with now reaches one of your own mailboxes (your member mailbox, or a personal agent's address): one whose author reads all your mail (author scope, for an author who reads the organization's mail or holds an access entry for your mailbox), or one that names your mailbox or its domain (selected). Another member's own_mailboxes rule never covers you. You see its name, wording, current tree, state, kind and author, and which of your own mailboxes it reaches. Its wording and tree are shown as written, so they can name other addresses (a condition on who an email is from or to). While it covers you, you also see who receives what it matches (receivers): how many API keys, webhooks and shares, and the member each belongs to, or the organization. You do not see which keys, webhooks or shares they are (no ids, names, prefixes or URLs), the other inboxes and domains its scope names, or its saved expectations. A page can hold fewer rules than limit, or none, and still carry a cursor (one request reads a bounded number of rules): keep reading until meta.cursor is null. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature. Only on your own dashboard session or the Primitive CLI.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRulesCoveringMe",
@@ -14108,6 +14254,147 @@ const operationManifest = [
 						"type": ["integer", "null"],
 						"exclusiveMinimum": 0
 					},
+					"receivers": {
+						"description": "Null when it could not be read in time; try again.",
+						"anyOf": [{
+							"type": "object",
+							"properties": {
+								"keys": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"owner": { "anyOf": [{
+												"type": "object",
+												"properties": {
+													"kind": {
+														"type": "string",
+														"const": "member"
+													},
+													"user_id": {
+														"type": "string",
+														"description": "The member's user id.",
+														"format": "uuid"
+													},
+													"name": {
+														"description": "Their name; null when they have none set.",
+														"type": ["string", "null"]
+													}
+												},
+												"required": [
+													"kind",
+													"user_id",
+													"name"
+												]
+											}, {
+												"type": "object",
+												"properties": { "kind": {
+													"type": "string",
+													"const": "organization",
+													"description": "Held by no member: an organization key, or one whose holder has left."
+												} },
+												"required": ["kind"]
+											}] },
+											"count": {
+												"type": "integer",
+												"exclusiveMinimum": 0
+											}
+										},
+										"required": ["owner", "count"]
+									},
+									"description": "API keys that work now (not revoked, expired or suspended) whose access lists the rule, or its live share: they read what it matches. Owner: the member who holds each, or the organization."
+								},
+								"webhooks": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"owner": { "anyOf": [{
+												"type": "object",
+												"properties": {
+													"kind": {
+														"type": "string",
+														"const": "member"
+													},
+													"user_id": {
+														"type": "string",
+														"description": "The member's user id.",
+														"format": "uuid"
+													},
+													"name": {
+														"description": "Their name; null when they have none set.",
+														"type": ["string", "null"]
+													}
+												},
+												"required": [
+													"kind",
+													"user_id",
+													"name"
+												]
+											}, {
+												"type": "object",
+												"properties": { "kind": {
+													"type": "string",
+													"const": "organization",
+													"description": "Held by no member: an organization key, or one whose holder has left."
+												} },
+												"required": ["kind"]
+											}] },
+											"count": {
+												"type": "integer",
+												"exclusiveMinimum": 0
+											}
+										},
+										"required": ["owner", "count"]
+									},
+									"description": "Webhooks that are sent what it matches: those whose key, as delivery acts as it, lists the rule or its live share (owner: the member who holds that key, or the organization), and the webhooks of the member the rule is shared with (owner: that member)."
+								},
+								"shares": {
+									"type": "array",
+									"items": {
+										"type": "object",
+										"properties": {
+											"beneficiary": {
+												"type": "object",
+												"properties": {
+													"kind": {
+														"type": "string",
+														"const": "member"
+													},
+													"user_id": {
+														"type": "string",
+														"description": "The member's user id.",
+														"format": "uuid"
+													},
+													"name": {
+														"description": "Their name; null when they have none set.",
+														"type": ["string", "null"]
+													}
+												},
+												"required": [
+													"kind",
+													"user_id",
+													"name"
+												]
+											},
+											"count": {
+												"type": "integer",
+												"exclusiveMinimum": 0
+											}
+										},
+										"required": ["beneficiary", "count"]
+									},
+									"description": "The rule's live share, if it has one (a rule is shared at most once): the member it gives what it matches to."
+								}
+							},
+							"required": [
+								"keys",
+								"webhooks",
+								"shares"
+							],
+							"description": "Who receives what the rule shares now, by person and count; empty unless it is an active grant rule."
+						}, { "type": "null" }]
+					},
 					"created_at": {
 						"type": "string",
 						"format": "date-time"
@@ -14122,6 +14409,7 @@ const operationManifest = [
 					"is_author",
 					"covers",
 					"current_version",
+					"receivers",
 					"created_at"
 				]
 			}
@@ -14356,7 +14644,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent.",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -14558,7 +14846,16 @@ const operationManifest = [
 						"warnings": {
 							"type": "array",
 							"items": { "type": "string" },
-							"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+							"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+						},
+						"server_explanation": {
+							"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+							"type": ["string", "null"]
+						},
+						"server_notes": {
+							"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+							"type": "array",
+							"items": { "type": "string" }
 						},
 						"compiled_by": { "type": "string" },
 						"vocabulary": { "type": "string" },
@@ -14655,7 +14952,7 @@ const operationManifest = [
 							"type": ["boolean", "null"]
 						},
 						"notice": {
-							"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+							"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 							"type": ["string", "null"]
 						}
 					},
@@ -15539,7 +15836,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent.",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -16114,7 +16411,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent.",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -16212,7 +16509,16 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+				},
+				"server_explanation": {
+					"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+					"type": ["string", "null"]
+				},
+				"server_notes": {
+					"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+					"type": "array",
+					"items": { "type": "string" }
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -16309,7 +16615,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				},
 				"target_can_accept": {
@@ -16441,7 +16747,16 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+				},
+				"server_explanation": {
+					"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+					"type": ["string", "null"]
+				},
+				"server_notes": {
+					"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+					"type": "array",
+					"items": { "type": "string" }
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -16538,7 +16853,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				}
 			},
@@ -17457,7 +17772,16 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+				},
+				"server_explanation": {
+					"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+					"type": ["string", "null"]
+				},
+				"server_notes": {
+					"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+					"type": "array",
+					"items": { "type": "string" }
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -17554,7 +17878,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				}
 			},
@@ -18347,7 +18671,16 @@ const operationManifest = [
 					"warnings": {
 						"type": "array",
 						"items": { "type": "string" },
-						"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+						"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					},
+					"server_explanation": {
+						"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+						"type": ["string", "null"]
+					},
+					"server_notes": {
+						"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+						"type": "array",
+						"items": { "type": "string" }
 					},
 					"compiled_by": { "type": "string" },
 					"vocabulary": { "type": "string" },
@@ -18444,7 +18777,7 @@ const operationManifest = [
 						"type": ["boolean", "null"]
 					},
 					"notice": {
-						"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+						"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 						"type": ["string", "null"]
 					}
 				},
@@ -18481,7 +18814,7 @@ const operationManifest = [
 		"binaryResponse": false,
 		"bodyRequired": false,
 		"command": "list-email-rule-results",
-		"description": "What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only); hidden counts deciding rules you cannot see. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
+		"description": "What each rule you can see decided about this email (matched, not matched, or not run), in the words of the deciding version. A do_not_share rule that matched it blocks sharing while active; earlier shares stay. Only a caller who can read the email gets an answer. classification is every fact the classifier read, as rule conditions read it. At most 50 rules are listed, results first; not_listed counts the rest. Another member's rule that decided on your own mail is listed read_only (dashboard and CLI only), with who receives what it shares (receivers) while it covers you; hidden counts deciding rules you cannot see. Needs mail:read, a member's own credential with their full access (not an API key, agent key or narrowed token), and the email rules feature.",
 		"hasJsonBody": false,
 		"method": "GET",
 		"operationId": "listEmailRuleResults",
@@ -18734,6 +19067,147 @@ const operationManifest = [
 									"name",
 									"email"
 								]
+							},
+							"receivers": {
+								"description": "With read_only: who receives what it shares; null unless it covers you now.",
+								"anyOf": [{
+									"type": "object",
+									"properties": {
+										"keys": {
+											"type": "array",
+											"items": {
+												"type": "object",
+												"properties": {
+													"owner": { "anyOf": [{
+														"type": "object",
+														"properties": {
+															"kind": {
+																"type": "string",
+																"const": "member"
+															},
+															"user_id": {
+																"type": "string",
+																"description": "The member's user id.",
+																"format": "uuid"
+															},
+															"name": {
+																"description": "Their name; null when they have none set.",
+																"type": ["string", "null"]
+															}
+														},
+														"required": [
+															"kind",
+															"user_id",
+															"name"
+														]
+													}, {
+														"type": "object",
+														"properties": { "kind": {
+															"type": "string",
+															"const": "organization",
+															"description": "Held by no member: an organization key, or one whose holder has left."
+														} },
+														"required": ["kind"]
+													}] },
+													"count": {
+														"type": "integer",
+														"exclusiveMinimum": 0
+													}
+												},
+												"required": ["owner", "count"]
+											},
+											"description": "API keys that work now (not revoked, expired or suspended) whose access lists the rule, or its live share: they read what it matches. Owner: the member who holds each, or the organization."
+										},
+										"webhooks": {
+											"type": "array",
+											"items": {
+												"type": "object",
+												"properties": {
+													"owner": { "anyOf": [{
+														"type": "object",
+														"properties": {
+															"kind": {
+																"type": "string",
+																"const": "member"
+															},
+															"user_id": {
+																"type": "string",
+																"description": "The member's user id.",
+																"format": "uuid"
+															},
+															"name": {
+																"description": "Their name; null when they have none set.",
+																"type": ["string", "null"]
+															}
+														},
+														"required": [
+															"kind",
+															"user_id",
+															"name"
+														]
+													}, {
+														"type": "object",
+														"properties": { "kind": {
+															"type": "string",
+															"const": "organization",
+															"description": "Held by no member: an organization key, or one whose holder has left."
+														} },
+														"required": ["kind"]
+													}] },
+													"count": {
+														"type": "integer",
+														"exclusiveMinimum": 0
+													}
+												},
+												"required": ["owner", "count"]
+											},
+											"description": "Webhooks that are sent what it matches: those whose key, as delivery acts as it, lists the rule or its live share (owner: the member who holds that key, or the organization), and the webhooks of the member the rule is shared with (owner: that member)."
+										},
+										"shares": {
+											"type": "array",
+											"items": {
+												"type": "object",
+												"properties": {
+													"beneficiary": {
+														"type": "object",
+														"properties": {
+															"kind": {
+																"type": "string",
+																"const": "member"
+															},
+															"user_id": {
+																"type": "string",
+																"description": "The member's user id.",
+																"format": "uuid"
+															},
+															"name": {
+																"description": "Their name; null when they have none set.",
+																"type": ["string", "null"]
+															}
+														},
+														"required": [
+															"kind",
+															"user_id",
+															"name"
+														]
+													},
+													"count": {
+														"type": "integer",
+														"exclusiveMinimum": 0
+													}
+												},
+												"required": ["beneficiary", "count"]
+											},
+											"description": "The rule's live share, if it has one (a rule is shared at most once): the member it gives what it matches to."
+										}
+									},
+									"required": [
+										"keys",
+										"webhooks",
+										"shares"
+									],
+									"description": "Who receives what the rule shares now, by person and count; empty unless it is an active grant rule."
+								}, { "type": "null" }]
 							}
 						},
 						"required": [
@@ -21142,7 +21616,7 @@ const operationManifest = [
 					}
 				},
 				"warnings": {
-					"description": "The compile response's warnings. Stored as sent.",
+					"description": "The compile response's warnings. Stored as sent, then any server note they lack on an address or domain the description names that the rule does not test (on a rule request, every compiler note on the rule).",
 					"maxItems": 10,
 					"type": "array",
 					"items": {
@@ -21986,7 +22460,16 @@ const operationManifest = [
 				"warnings": {
 					"type": "array",
 					"items": { "type": "string" },
-					"description": "As the member who asked sent them, normally from their compile. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+					"description": "As the member who asked sent them, normally from their compile, then every compiler note on the rule's tree and words they lack. The compiler's note that the rule matches nearly everything, in its own wording, counted that member's recent mail: anyone else reads it naming them."
+				},
+				"server_explanation": {
+					"description": "What the rule as asked actually does: Primitive's own reading of the request's tree, never the words of the member who asked or of a model. Null when the tree no longer reads as one.",
+					"type": ["string", "null"]
+				},
+				"server_notes": {
+					"description": "Primitive's own notes on the rule as asked, worked out from its tree and description each time the request is read, and to the member asked while pending, how to test it on look-alikes. Unlike warnings, never written by the member who asked, though a note can quote their words or tree values.",
+					"type": "array",
+					"items": { "type": "string" }
 				},
 				"compiled_by": { "type": "string" },
 				"vocabulary": { "type": "string" },
@@ -22083,7 +22566,7 @@ const operationManifest = [
 					"type": ["boolean", "null"]
 				},
 				"notice": {
-					"description": "For the member asked, while pending: what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
+					"description": "For the member asked, while pending: what the rule actually does (server_explanation), Primitive's warnings, then what accepting would share. For the member who asked, once accepted with changes: that the request is not what is shared. Else null.",
 					"type": ["string", "null"]
 				}
 			},
@@ -26627,8 +27110,8 @@ const operationManifest = [
 					"description": "HTTP status code returned by the endpoint"
 				},
 				"body": {
-					"type": "string",
-					"description": "Response body (truncated to 1000 characters)"
+					"description": "The receiver response text, only with organization-wide mail.raw:read. Null without that access because a receiver can echo a raw download link.",
+					"type": ["string", "null"]
 				},
 				"signature": {
 					"type": "string",
@@ -52645,18 +53128,19 @@ function emptyEmailListHint(input) {
 }
 // src/oclif/endpoint-event-types.ts
 const EVENT_TYPES_FLAG_OPERATIONS = /* @__PURE__ */ new Set(["createEndpoint", "updateEndpoint"]);
-const EVENT_TYPES_FLAG_DESCRIPTION = "Event types this endpoint subscribes to, comma separated or repeated (sets rules.event_types). Omitting the subscription means every event type except the opt-in sent_email.* and email_rule_request.* events, which an endpoint receives only when it lists them; sent_email.* and email_rule_request.* each expand to all four. Rule request events can be listed only when the webhook is created, signed in as yourself; such a webhook is yours and always a route target. Keep email.received in the list if the endpoint also handles inbound mail. On update, the endpoint's other rules are kept.";
+const EVENT_TYPES_FLAG_DESCRIPTION = "Event types this endpoint subscribes to, comma separated or repeated (sets rules.event_types). Omitting the subscription means every event type except the opt-in sent_email.*, email_rule_request.* and email_rule_objection.* events, which an endpoint receives only when it lists them; each of those shorthands expands to all four. Rule request and objection events can be listed only when the webhook is created, signed in as yourself; such a webhook is yours and always a route target. Keep email.received in the list if the endpoint also handles inbound mail. On update, the endpoint's other rules are kept.";
 /** Shorthands the CLI expands, since the server would store them as literals that match nothing. */
 const WILDCARDS = {
 	"sent_email.*": SENT_EMAIL_EVENT_TYPES,
-	"email_rule_request.*": EMAIL_RULE_REQUEST_EVENT_TYPES
+	"email_rule_request.*": EMAIL_RULE_REQUEST_EVENT_TYPES,
+	"email_rule_objection.*": EMAIL_RULE_OBJECTION_EVENT_TYPES
 };
 const KNOWN_EVENT_TYPES = new Set(WEBHOOK_EVENT_TYPES);
 var EventTypesFlagError = class extends Error {};
 /**
 * Turn the raw `--event-types` values into the list to store: split on
-* commas, trim, expand `sent_email.*` and `email_rule_request.*`, and drop duplicates while keeping the
-* order the caller gave.
+* commas, trim, expand the shorthands in WILDCARDS, and drop duplicates while
+* keeping the order the caller gave.
 */
 function parseEventTypesFlag(values) {
 	const out = [];
@@ -52671,7 +53155,7 @@ function parseEventTypesFlag(values) {
 			out.push(entry);
 		}
 	}
-	if (out.length === 0) throw new EventTypesFlagError("--event-types needs at least one event type. To receive every event type except the opt-in sent_email.* and email_rule_request.* events, omit the subscription instead.");
+	if (out.length === 0) throw new EventTypesFlagError("--event-types needs at least one event type. To receive every event type except the opt-in sent_email.*, email_rule_request.* and email_rule_objection.* events, omit the subscription instead.");
 	if (out.length > 50) throw new EventTypesFlagError(`--event-types accepts at most 50 event types (got ${out.length}).`);
 	return out;
 }
@@ -54574,7 +55058,7 @@ function savedConnectedProfiles(configDir, exclude) {
 */
 async function otherProfiles(configDir, session, current) {
 	if (session) try {
-		const { connectedProfilesForSession } = await import("./machine-session-CI8tnGzz.js").then((n) => n.s);
+		const { connectedProfilesForSession } = await import("./machine-session-D39TUEGF.js").then((n) => n.s);
 		return {
 			inSession: true,
 			profiles: connectedProfilesForSession(configDir, session, current)
@@ -54648,24 +55132,25 @@ async function explainPendingMailNotFound(configDir, emailId, write = (line) =>
 		if (outcome.kind === "dropped") write(`Dropped the pending notice for ${id} from profile ${current.profile} after ${outcome.reads} consecutive not_found reads; the email is no longer visible to this profile.\n`);
 	} catch {}
 }
-const RULE_REQUEST_WEBHOOK_CREATE_HINT = "Hint: a webhook for rule request events is made by the person it is for, signed in as themself: after `primitive login`, run this without --api-key, PRIMITIVE_API_KEY or PRIMITIVE_AGENT_PROFILE set, or create it in the dashboard. An API key, another app or an agent cannot make one. If you are already signed in as yourself, try again. It is a route target whatever your access, so it never takes a domain's or the organization's default slot.";
-const RULE_REQUEST_WEBHOOK_HTTP_HINT = "Hint: rule request events go only to an http webhook (kind http).";
-const RULE_REQUEST_WEBHOOK_SUBSCRIBE_HINT = "Hint: rule request events go only to a webhook made for them. If this webhook does not list them yet, it cannot be given them: create a new one with `--event-types 'email_rule_request.*'`, signed in as yourself. If it does, only its maker, signed in as themself, can change it.";
-const RULE_REQUEST_WEBHOOK_KEY_HINT = "Hint: a webhook for rule request events is made by the person it is for, signed in as themself, and stays theirs: it cannot be given to an API key.";
-const RULE_REQUEST_WEBHOOK_CHANGE_HINT = "Hint: only the person who made a webhook for rule request events, signed in as themself (not with an API key, another app or an agent), can change it. It can be deleted as any other webhook can.";
-const RULE_REQUEST_WEBHOOK_DEFAULT_HINT = "Hint: a webhook for rule request events is always a route target. Leave out --no-is-route-target, --takeover and --no-takeover (is_route_target: false and takeover in a raw body).";
-const RULE_REQUEST_EVENT_PREFIX = "email_rule_request.";
+const RULE_REQUEST_WEBHOOK_CREATE_HINT = "Hint: a webhook for rule request or objection events is made by the person it is for, signed in as themself: after `primitive login`, run this without --api-key, PRIMITIVE_API_KEY or PRIMITIVE_AGENT_PROFILE set, or create it in the dashboard. An API key, another app or an agent cannot make one. If you are already signed in as yourself, try again. It is a route target whatever your access, so it never takes a domain's or the organization's default slot.";
+const RULE_REQUEST_WEBHOOK_HTTP_HINT = "Hint: rule request and objection events go only to an http webhook (kind http).";
+const RULE_REQUEST_WEBHOOK_SUBSCRIBE_HINT = "Hint: rule request and objection events go only to a webhook made for them. If this webhook does not list them yet, it cannot be given them: create a new one with `--event-types` naming them (such as 'email_rule_request.*' or 'email_rule_objection.*'), signed in as yourself. If it does, only its maker, signed in as themself, can change it.";
+const RULE_REQUEST_WEBHOOK_KEY_HINT = "Hint: a webhook for rule request or objection events is made by the person it is for, signed in as themself, and stays theirs: it cannot be given to an API key.";
+const RULE_REQUEST_WEBHOOK_CHANGE_HINT = "Hint: only the person who made a webhook for rule request or objection events, signed in as themself (not with an API key, another app or an agent), can change it. It can be deleted as any other webhook can.";
+const RULE_REQUEST_WEBHOOK_DEFAULT_HINT = "Hint: a webhook for rule request or objection events is always a route target. Leave out --no-is-route-target, --takeover and --no-takeover (is_route_target: false and takeover in a raw body).";
+/** The event families, of those this CLI lists, that the API keeps to a webhook its person made for them, matched by prefix as the API matches them. */
+const MEMBER_EVENT_PREFIXES = ["email_rule_request.", "email_rule_objection."];
 function record(value) {
 	return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
 }
 /**
-* Whether a create or update body lists any rule request event. Matched by
-* prefix, as the API matches it, so a raw body's literal
-* `email_rule_request.*` counts too.
+* Whether a create or update body lists any rule request or objection
+* event. Matched by prefix, as the API matches it, so a raw body's
+* literal `email_rule_request.*` counts too.
 */
 function listsRuleRequestEvents(body) {
 	const types = record(record(body)?.rules)?.event_types;
-	return Array.isArray(types) && types.some((t) => typeof t === "string" && t.startsWith(RULE_REQUEST_EVENT_PREFIX));
+	return Array.isArray(types) && types.some((t) => typeof t === "string" && MEMBER_EVENT_PREFIXES.some((prefix) => t.startsWith(prefix)));
 }
 function refusalReason(payload) {
 	const top = record(payload);
@@ -55971,7 +56456,7 @@ function createOperationCommand(operation) {
 						...tail ? { pastFlag: "--since" } : query.cursor !== void 0 ? { pastFlag: "--cursor" } : {},
 						nextCursor: tail ? null : more,
 						caller: tail || more ? null : await readCallerMailFor(auth, apiClient.client)
-					}) : emptyRuleListHint(operation.sdkName, query) ?? EMPTY_RESULT_HINTS[operation.sdkName];
+					}) : emptyRuleListHint(operation.sdkName, query) ?? emptyDeliveriesHint(operation.sdkName, query) ?? EMPTY_RESULT_HINTS[operation.sdkName];
 					if (hint && jsonOutput) summary.push(hint);
 					else if (hint) process.stderr.write(`${hint}\n`);
 				}
@@ -56078,6 +56563,20 @@ function emptyRuleListHint(sdkName, query) {
 		return said("objections", box && status ? "pending objections you made" : box ? "objections you made" : status ? "pending objections" : null, [...box ? ["--box all"] : [], ...status ? ["--status any"] : []]);
 	}
 }
+/**
+* An empty delivery list narrowed by a filter (--endpoint-id, --status,
+* --event-type and the rest) names the filters given, in place of the general
+* hint, which reads as if nothing was ever delivered, and keeps its point that
+* test fires are not logged. Undefined for any other list, or when no filter
+* was given.
+*/
+function emptyDeliveriesHint(sdkName, query) {
+	if (sdkName !== "listDeliveries") return void 0;
+	const flags = listFilters(query).map((name) => `--${parameterFlagName(sdkName, name)}`);
+	if (flags.length === 0) return void 0;
+	if (query.cursor !== void 0) return "(no results) No more deliveries match these filters.";
+	return `(no results) No deliveries match ${flags.length === 1 ? flags[0] : `${flags.slice(0, -1).join(", ")} and ${flags[flags.length - 1]}`}. Test fires from \`primitive endpoints test\` are not logged here; real deliveries are, when an event fans out to the endpoint. Leave out ${flags.length === 1 ? flags[0] : "a filter"} to list more.`;
+}
 function canonicalizeCliReferences(description) {
 	return description.replaceAll("`primitive emails:latest`", "`primitive emails latest`").replaceAll("`primitive describe emails:get-email | jq '.responseSchema.properties'`", "`primitive describe emails:get | jq '.responseSchema.properties'`");
 }